WordPress Download Manager Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Download Manager plugin for WordPress, affecting all versions through 3.3.12. The issue arises from inadequate file path validation in the 'savePackage' function, which enables authenticated attackers with Author-level access or higher to delete arbitrary files on the server. This vulnerability could lead to remote code execution if a critical file, such as 'wp-config.php', is deleted.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server. If a sensitive file is removed, it could facilitate remote code execution.

Remediation

Users are advised to update the Download Manager plugin to version 3.3.13 or a newer patched version.